Now let's translate this into our example.
So in our example we're going to be targeting dimittis floatable machine.
So our web server is going to be dimittis portable machine and we're not going to be using a DNS server
so we're not going to be using a name like Facebook dotcom will be accessing the Web site directly use
an IP address.
So like we said before if we just go here to our portable machine I type in ifconfig you'll see that
my IP is 10 20 14 to 14.
And if I go here to my to upload it to my tally machine you'll see that if I type in 10 20 14 to 14
you'll see that I can access my portable machine.
So the web server here is dimittis Teutul machine itself the web applications are limited the page my
admin DVD.
And all of these so these are why applications and when you click on them you can see for example here
it's written in BHB.
So it's written in this programming language.
It's also using a wide scale server which can be accessed through ph my Oddment.
So these are just technologies used on the web server but the web server itself is the meat asteroidal
machine here.
So when you put the IP address when you put 10:24 into 14 we're actually accessing the floatable machine
and inside dimittis voidable machine we have technologies we have interpretor that's run in PH.
We have a web server and a database.
And these are running the Web Application for us which is Matile today DVD.
And all of them so when these components leave us to no one how we can hack a website so there is more
than one thing that we can exploit to gain control over a website.
Now the main thing the obvious things that you think of is the web applications.
So it's the thing that you always interact with.
For example in Facebook it's where you search for stuff and where you upload pictures where you write
posts.
All of these things are handled by the web application because it's the thing that you click the thing
that you interact with.
So for example if I go here on Matile day and I start browsing the web page this is my web application
so every time I click on something it's being handled and executed by the web application on the web
server.
So if I could exploit this web application in some way if I could gain access to it if I could connect
to the database because obviously this web application connects to the database then I'll be able to
maybe gain control over the Web site and maybe even gain access to the web server and then get access
to other web sites on the same server.
We'll talk about all of that later in the course.
The other way of gaining access to Web sites is using the computer itself.
So let's say you claim your target was the VW 8 and you couldn't get in.
You couldn't find an exploit in the web application itself.
You tried everything you tried all the explosives will go to talk about and you just couldn't get in.
Then your other option would be to exploit the programs installed on that computer because we said our
web server or the Web site is installed on a normal computer just like your home computer.
So if you couldn't get in use and do web applications what if there is one of the programs installed
on the web computer on the computer itself.
How does an exploit has a buffer overflow or remote execution exploit.
What if the web server itself or the database program the program that's running the database itself
had a remote root exploit that allows you to just gain access to the whole web server including all
the Web sites inside it.
So this will be really cool if you could get it if you couldn't find anything wrong with the applications
installed on the web server on the operating system.
Then you could target the humans because we know Web sites are managed by humans.
For example Facebook you can't target mark or you can target the admins of Facebook for example.
These admins obviously have more privileges on that website than new.
And then they might be able to upload sensitive files to that Web site and then you can control it and
Hockett by hacking into one of those people.
So instead of maybe the Web site is very secure and the server is very secure and there is no way that
you can get in but you can always exploit the humans using social engineering attacks and client side
attacks to gain control or hack one of the people that manage that Target Web site and then maybe gain
access to it.
Now this course will be concerned with the web application penetration testing that's concerned with
the first step with the first approach.
So we're going to learn how to discover and exploit a large number of vulnerabilities that can be fine
found in the web application itself.
We're not going to be talking about server side attacks so the attacks that exploit the operating system
and the applications installed on the operating system itself of the web server and we're not going
to be talking about the client side attacks about attacking humans and how can their accounts and then
gain access to the Web site.
All of these these two the last two sections are actually covered into my general ethical hacking course
so I have of course called them an ethical hacking from scratch work which covers those two aspects.
Therefore in this course we're going to be focusing on the web application penetration testing sites
so on how can the websites based on the web applications installed on that Web site.